/*
* In their BAN logic article, Burrows, Abadi and Needham propose the
* following modification of the Yahalom protocol. (See yahalom.cry for
* the unmodified Yahalom.) As an advantage, they mention that this
* protocol is easier to analyze because it does not use an uncertified
* key.
*
* A -> B : A, Na
* B -> S : B, Nb, { msg2 (A, Na) }Kbs
* S -> A : Nb, { msg3(B, Kab, Na) }Kas, { msg4a(A, Kab, Nb) }Kbs
* A -> B : { msg4a(A, Kab, Nb) }Kbs, { msg4b(Nb) }Kab
*
* The main difference to the original Yahalom protocol is that
* the original does not include Nb in message 4a. Moreover, the
* original includes Nb in the ciphertexts in messages 2 and 3. In the
* modified version, this is no longer necessary.
*
* Alan Jeffrey, v0.0.2 2001/02/26
* Christian Haack, modified for v1.1.0, 2004/09/15
*/